Dernière mise à jour : July 27, 2026
1. Encrypted communications
The entire site and its programming interfaces are served exclusively over HTTPS (TLS 1.2 or higher). Unencrypted requests are redirected. Generated documents are delivered through signed links.
2. Authentication and passwords
Passwords are never stored in clear text: they are hashed server-side by our authentication provider using a cost-configurable algorithm (bcrypt). Email verification is mandatory, and publicly breached passwords are rejected at sign-up.
3. Role-based access control
Roles (user, editor, administrator) live in a dedicated table and are verified server-side on every sensitive call. Administration routes are protected by a server check, never by a mere interface condition.
4. Data isolation
Every application table enforces row-level security policies: an account can only read or modify its own assessments, invoices, consents and logs. Privileged operations run only inside server functions.
5. Validation and application hardening
All input is validated server-side (typed schemas, length bounds), queries are parameterized, user content is escaped on render, and payment webhooks are verified by cryptographic signature.
6. Rate limiting
Sign-in attempts, password resets and outbound emails are rate-limited per address and per period to counter brute-force attacks and abusive sending.
7. Logging
Sign-ins, data exports, privacy requests and administrative actions are timestamped and kept in reviewable logs. IP addresses are truncated before being stored.
8. Payments
No full card data ever transits or is stored on our servers: payments are processed by Stripe, certified PCI-DSS Level 1.
9. Processors and hosting
Data is hosted on managed cloud infrastructure with encrypted backups. Each processor is assessed and bound by confidentiality and security commitments.
10. Incident management
Viabilio maintains a privacy incident register. Any incident presenting a risk of serious injury is documented, remediated, then reported to affected individuals and to the Commission d'accès à l'information, as required by Law 25.
11. Reporting a vulnerability
If you discover a security flaw, write to admin@viabilio.com with a reproducible description. We acknowledge within 2 business days and commit not to pursue legal action for responsible disclosure.